Analysis

  • max time kernel
    130s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-11-2023 23:20

General

  • Target

    Nueva carpeta (3)/PuzzlesLib-v8.1.9-1.20.1-Fabric.jar

  • Size

    949KB

  • MD5

    da2fb749ded9ea96a5cc49eab3812b54

  • SHA1

    7b7ea088a706a1767cee5604e8b0d95bd833fcfd

  • SHA256

    6b243da214460462afe221792c932df651852d5b06d33af3cc4ae15e022ae71a

  • SHA512

    c6f5fe91bbd78a10c4b072602e458c0a6f400e93b74be89728721b7c482e717e5e575dcb8124fd3f119c39f2d54257b562246294d0149093d627e1add806b3ed

  • SSDEEP

    24576:yjeY0whJzCVgX0+UwF3iVAv2qHj9hHwcw7:seSrrknwFyiuMvHE

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar "C:\Users\Admin\AppData\Local\Temp\Nueva carpeta (3)\PuzzlesLib-v8.1.9-1.20.1-Fabric.jar"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2216
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:4524

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2216-2-0x00000174A8CE0000-0x00000174A9CE0000-memory.dmp

    Filesize

    16.0MB

  • memory/2216-11-0x00000174A8CC0000-0x00000174A8CC1000-memory.dmp

    Filesize

    4KB